The authors of [1]} use parameters for which they have 100 bits of security. This means both the underlying \(\) -instance should require time \(2^{100}\)  to solve using the best quantum algorithms and the soundness should be \(2^{-100}\) . We will use this benchmarking for comparing the different schemes.
